key recovery from protocols using ed25519_add_scalar about ed25519

[orlp]

I'm too busy right now to look into this in detail.

However, I can say that when I added ed25519_add_scalar it was only intended for keypair generation. One such usage is to generate a keypair with a provably random public key - this has uses in p2p protocols. It was never intended to be used after you've signed stuff with a keypair, and I didn't study its security at all.

[MentalCollatz]

The attack also works if you use the same base key to generate multiple keypairs, even if you never sign anything with the base key. I can submit a pull request if you're busy.

[Codewyvern]

Please submit one :) this indeed sounds like a serious issue.

[orlp]

Reviewing a pull request is not much less work than making it myself - I have to audit it regardless.

[orlp]

Sorry for the late response, this fell off my map for a while.

After some more thinking I believe this attack to be legitimate, and your solution seems so as well. It never applied to my use case (where every keypair is only added to once, and is never used before being added to), but I can see legitimate use cases where this becomes an issue.

I will implement the fix in a moment.

[orlp]

Fixed with 09ec167.